Live data from Hacker News

Executable code snippets in Bing

techcrunch.com

21–30 of 51 posts

Re: Executable code snippets in Bing

#21
The sandboxing is interesting ... Each process is running in a directory on the same server.

Also there's some files that are visible that probably shouldn't be, including one named "codechecker-android-release-key.keystore"...

For the curious, try running the code block. You can uncomment/commment things out to see different results as there's a cap on the amount of stdout printed.

    import java.net.URLClassLoader;
    import java.io.*;
    import java.net.*;
    
    class  Solution
    {
    	private static void printFile(String path) throws Exception {
    		System.out.println("File: " + path);
    		InputStream in = new FileInputStream(path);
    		byte buf[] = new byte[1024];
    		int len;
    		while( (len = in.read(buf)) > 0 ) {
    			System.out.write(buf, 0, len);
    		}
    		System.out.flush();
    	}
    	
    	final protected static char[] hexArray = "0123456789ABCDEF".toCharArray();
    	private static String bytesToHex(byte[] bytes) {
    	    char[] hexChars = new char[bytes.length * 2];
    	    for ( int j = 0; j >> 4];
    	        hexChars[j * 2 + 1] = hexArray[v & 0x0F];
    	    }
    	    return new String(hexChars);
    	}
    
        private static void printFileHex(String path) throws Exception {
    		System.out.println("File: " + path);
    		InputStream in = new FileInputStream(path);
    		ByteArrayOutputStream out = new ByteArrayOutputStream();
    		byte buf[] = new byte[1024];
    		int len;
    		while( (len = in.read(buf)) > 0 ) {
    			out.write(buf, 0, len);
    		}
    		byte bytes[] = out.toByteArray();
    		System.out.println(bytesToHex(bytes));
    		System.out.flush();
    	}	
    	
    	public static void main (String[] args) throws Exception
    	{
    		Class clazz = Class.forName("java.lang.ClassLoader");
    		URLClassLoader cl = 
    		  (URLClassLoader) Thread.currentThread().getContextClassLoader();
    	    System.out.println("Classpath:");
    		for(java.net.URL url : cl.getURLs()) {
    			System.out.println("" + url);
    		}
    		File local = new File("");
    		System.out.println("Local path: " + local.getAbsolutePath());
    		
    		System.out.println("Files:"); 
    		File root = new File("/");  
    		String list[] = root.list();		
    		System.out.println("# root files: " + list.length);
    		
    		//printFile("/etc/passwd");
    		printFileHex("/etc/codechecker-android-release-key.keystore");
    		
    		System.out.println("# root files: " + list.length);
    		for(String base : new String[]{ "/etc", "/bin", "/sbin", "/usr"}) {
    		  for(String name : new File(base).list()) {
    		     System.out.println(base + "/" + name);
    		  }
    		}
    	}
    }

Re: Executable code snippets in Bing

#25
Running this is amusing:

  import os
  print '\n'.join(os.listdir('/'))
Personally, I'm partial to running IPython under Sandstorm for this kind of thing. (Also, if I were to host it, I'd be very nervous about any technique not involving equal or greater paranoia.)

Re: Executable code snippets in Bing

#26

Google used to have code search but killed it.

They also killed being able to search for symbols. That still bugs me.

And they ruined Maps. It's like Google doesn't want to be in the search business any more. No growth potential to deliver "maximum shareholder value" and bonuses for the MBAs.

Re: Executable code snippets in Bing

#27

Pretty cool when it appears. You can edit it, and the examples are written in a way that the output helps explain the flow (like showing the pivot and array state in each pass of a quicksort). I'm surprised it doesn't support Javascript though, since it's now so popular. It also doesn't seem to support anything advanced or synonyms for terms. I can search for "Reverse array python" but not "Reverse list python" (tech…

I worked on this project. We're building up the list of samples of additional programs/queries, so the number of queries you should see the editor for will expand in the coming days.

Re: Executable code snippets in Bing

#28
post #25

Running this is amusing: import os print '\n'.join(os.listdir('/')) Personally, I'm partial to running IPython under Sandstorm for this kind of thing. (Also, if I were to host it, I'd be very nervous about any technique not involving equal or greater paranoia.)

A little more about the OS environment this is running in: https://www.hackerrank.com/environment

Re: Executable code snippets in Bing

#29
post #21

The sandboxing is interesting ... Each process is running in a directory on the same server. Also there's some files that are visible that probably shouldn't be, including one named "codechecker-android-release-key.keystore"... For the curious, try running the code block. You can uncomment/commment things out to see different results as there's a cap on the amount of stdout printed. import java.net.URLClassLoader; im…

You can read more about the environment here: https://www.hackerrank.com/environment

We have a cluster of codechecker servers of the above type, which share the load of incoming queries. On each, sandboxing is via a chroot-based system. Programs get a fixed amount of memory/time.

Re: the codechecker keyfile - we're looking into this, as I'm not an android expert - but quick searching tells me this is used to sign apks. Our codechecker supports android builds, so that's probably what this is used for. This key is not used to sign anything official (like throwaway id_rsa you create when needed). Again, I'm not the expert on this and I'll add a confirmation here shortly.

That said, if anyone finds something a vulnerability/way out of the sandbox, please shoot me a mail (anil @ hackerrank) if you'd like to do a private disclosure.

Re: Executable code snippets in Bing

#30

Pretty cool when it appears. You can edit it, and the examples are written in a way that the output helps explain the flow (like showing the pivot and array state in each pass of a quicksort). I'm surprised it doesn't support Javascript though, since it's now so popular. It also doesn't seem to support anything advanced or synonyms for terms. I can search for "Reverse array python" but not "Reverse list python" (tech…

I worked on this project. We're building up the list of samples of additional programs/queries, so the number of queries you should see the editor for will expand in the coming days.

Any plans to add Javascript as a language?
Post reply on HN